Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - invader7

Pages: [1]
1
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 15, 2013, 09:14:34 pm »
Quote from: techb on December 15, 2013, 09:03:07 pm

I was a "production" employee at an ISP tech support center, the amount of fail they had in there systems was epic. People like me, and people like in "production" WILL break things. Don't assume all others are stupid. I ran circles around the IT at my last job, and they all thought it was my supervisor. I quite on my own terms and my supervisor is still there, just don't underestimate the little guys. I did stuff to break systems in a few jobs I had, Lulz use putty again I DARE ya Mr telemarketer.


production = developement , sorry my mistake !! i wanted to write developement stage not production !!!

2
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 15, 2013, 08:34:23 pm »
Quote from: Geoff on December 14, 2013, 02:33:48 pm
and youve obviously made sure short tags and such are disabled as well?


obviously yes :) you mean <? <?= , im searching for 2 characters <?  , something else in mind ?

Quote from: ande on December 14, 2013, 02:44:31 pm
Honestly you should just use htmlspecialchars() or htmlentities(), either on insert or on output from DB.


Yes you are right ! , its a targeted product for a closed group of people who are not supposed to hack it and its on production. But you are right , i will follow :)

The best way to write safer code is manage to bypass your own code and then improve it ;)

3
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 14, 2013, 01:03:20 pm »
Quote from: Geoff on December 14, 2013, 03:41:41 am


I think you're missing the idea here


Security should be designed into your software, not added in as an after thought. This whole "it doesnt matter its a quick fix now" ideology is stupid


Design the software with security in mind, dont design it to have security patched in later. It will not be as effective.

I think your thoughts are right , thanks !

Quote from: Geoff on December 14, 2013, 03:41:41 am
You take input and sanitize it.



Lets say if you check for that string specifically... would it cover


<?php echo phpinfo(INFO_MODULES); ?> or any number of other ways it can be modified? how about every other way other tags can possibly be implemented? You dont strip entire bits of code... you strip santize what makes it code.


No this isn't dangerous because im searching for <?php , not the whole phpinfo()... so when i find <?php i make it <!--?php

4
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 11:52:44 pm »
Quote from: ande on December 13, 2013, 11:46:12 pm
No. What I mean is that it is not directly dangerous to store PHP code in the database as it will not be executed if just print it to page. In order for that to be dangerous you will have to run the database result in the eval() function for it to execute.


Yes :) ok thanks a lot !!!

5
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 11:36:05 pm »
Quote from: ande on December 13, 2013, 11:26:32 pm
The PHP tags/code wouldn't be able to execute unless you ran it through eval().


What do you mean , how i'm supposed to run eval() if i cant enclose it at <?php tag ?

6
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 10:30:55 pm »
Quote from: ande on December 13, 2013, 10:21:59 pm
Client side attacks (XSS) would allow an attacker to steal your session(s)/cookies and be logged in (if there is a login) without even typing username/password. But you are correct. XSS cannot harm the server directly.


Yes i know about cookie stealing , i was afraid about posting <?php tags to my messages. Thanks a lot for your time !! I appreciate it !

7
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 10:03:08 pm »
Quote from: ande on December 13, 2013, 09:53:03 pm
This is a classic XSS example. I suggest you read up on it. Why don't you just filter everything with htmlspecialchars() or htmlentities()? I sure hope you are escaping the database query with PDO prepared statements or mysql_real_escape_string()



Yes i have my queries secured thanks !! I know im XSS vulnerable right now but its ok because im in development stage , for one moment i thought that im exposing my server to a server side script. But im safe ! Client side attacks are harmless for the server (i think :P )

8
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 09:47:13 pm »
Quote from: techb on December 13, 2013, 09:40:49 pm
It's a quick and dirty way, but removing the entries all together would be ideal.




thanks !!

9
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 09:32:43 pm »
Quote from: techb on December 13, 2013, 09:28:26 pm
Why not remove or reject the entries?


Don't know just a quick thought , is it insecure way ? or just a waste..

10
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 09:26:44 pm »
Thanks !! i will , i im controlling tags like this :


if user wants to post <?php echo phpinfo(); ?> i will make it <!--?php echo phpinfo(); ?-->


is this enough ?


im using php 5.3.3

11
Hacking and Security / Re: Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 08:56:10 pm »
Quote from: Kulverstukas on December 13, 2013, 08:46:20 pm
so then why don't don't you use regex and strip the tags, or just remove the text along with those tags...? however I am sure there are better ways to do it :P


I don't want to remove all tags , im using regex to find the tags i want to remove but i didn't thought about script ! is this dangerous at the moment i have to rush ? Always talking for the server !

12
Hacking and Security / Unfiltered form accepts <script> tag , it's dangerous ?
« on: December 13, 2013, 08:42:57 pm »
Hello , i have a message form which saves the contents to database and shows it when requested , i used to filter some hardcoded tags like <?php ?> but i found it is vulnerable to <script>alert(1);</script>


Javascript is client side , so the vulnerability is dangerous only for clients (there are no clients till now). Is there any rush for me to patch this bug as soon as possible ? Is there any fear for compromising my server or find any info for the server ?

Pages: [1]